Extracted

• • Target

    44c75b1c40dcc3acd0736908489e2ea02b93f5dba11fb1fb7847ad4d62b56883

  • Size

    1.8MB

  • MD5

    f07885b5720798735df239ba96a9788e

  • SHA1

    eb9a21552b61d4be8dad2928945d72afa23e9262

  • SHA256

    44c75b1c40dcc3acd0736908489e2ea02b93f5dba11fb1fb7847ad4d62b56883

  • SHA512

    d35e191e3425932a98f31f8ad191cc40865ced4ae486bb0fa0553afeca091837410bcdc6b8d0d744fb1ef639666f81464813134c56ce24cbfd441462adb4bf04

  • SSDEEP

    49152:2wBA0FOqe0cDhapYdwdKXcurXEJIG5rgzIgt6At:NAsz2aZdKXcyXEJlkIort

  Score

  10^/10

  stealcbratdefense_evasiondiscoverystealer

  • Stealc

    Stealc is an infostealer written in C++.

    stealerstealc

  • Stealc family

    stealc

  • Identifies VirtualBox via ACPI registry values (likely anti-VM)

    defense_evasion

  • Checks BIOS information in registry

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    defense_evasion

  • Checks installed software on the system

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery

  • Suspicious use of NtSetInformationThreadHideFromDebugger

  behavioral1behavioral2